'\" te
.\"  Copyright 1989 AT&T
.\" Copyright (C) 2005, Sun Microsystems, Inc. All Rights Reserved
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH KEYLOGIN 1 "Feb 25, 2017"
.SH NAME
keylogin \- decrypt and store secret key with keyserv
.SH SYNOPSIS
.LP
.nf
\fB/usr/bin/keylogin\fR [\fB-r\fR]
.fi

.SH DESCRIPTION
.LP
The \fBkeylogin\fR command prompts for a password, and uses it to decrypt the
user's secret key. The key can be found in the \fB/etc/publickey\fR file (see
\fBpublickey\fR(5)) or the  NIS map ``publickey.byname''
in the user's home domain. The sources and their lookup order
are specified in the \fB/etc/nsswitch.conf\fR file. See \fBnsswitch.conf\fR(5).
Once decrypted, the user's secret key is stored by the local key server
process, \fBkeyserv\fR(8). This stored key is used when issuing requests to
any secure RPC services, such as \fBNFS\fR. The program
\fBkeylogout\fR(1) can be used to delete the key stored by \fBkeyserv\fR
\fB\&.\fR
.sp
.LP
\fBkeylogin\fR fails if it cannot get the caller's key, or the password given
is incorrect. For a new user or host, a new key can be added using
\fBnewkey\fR(8).
.SH OPTIONS
.LP
The following options are supported:
.sp
.ne 2
.na
\fB\fB-r\fR\fR
.ad
.RS 6n
Update the \fB/etc/.rootkey\fR file. This file holds the unencrypted secret key
of the superuser. Only the superuser can use this option. It is used so that
processes running as superuser can issue authenticated requests without
requiring that the administrator explicitly run \fBkeylogin\fR as superuser at
system startup time. See \fBkeyserv\fR(8). The \fB-r\fR option should be used
by the administrator when the host's entry in the publickey database has
changed, and the \fB/etc/.rootkey\fR file has become out-of-date with  respect
to the actual key pair stored in the publickey database. The permissions on the
\fB/etc/.rootkey\fR file are such that it can be read and written by the
superuser but by no other user on the system.
.RE

.SH FILES
.ne 2
.na
\fB\fB/etc/.rootkey\fR\fR
.ad
.RS 17n
superuser's secret key
.RE

.SH SEE ALSO
.LP
.BR chkey (1),
.BR keylogout (1),
.BR login (1),
.BR nsswitch.conf (5),
.BR publickey (5),
.BR attributes (7),
.BR keyserv (8),
.BR newkey (8)
